@oneuptime/common 13.0.5 → 13.0.7

package/build/dist/Server/Services/ServiceLevelObjectiveService.js

@@ -16,8 +16,10 @@ import OneUptimeDate from "../../Types/Date";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import SloWindowType from "../../Types/ServiceLevelObjective/SloWindowType";
+import { escapeMarkdownInline } from "../../Utils/Markdown/MarkdownEscape";
 import DatabaseConfig from "../DatabaseConfig";
 import QueryHelper from "../Types/Database/QueryHelper";
+import { resolveReferenceId } from "../Utils/Database/ProjectScopedReferenceValidator";
 import logger from "../Utils/Logger";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import AlertSeverityService from "./AlertSeverityService";
@@ -26,9 +28,24 @@ import MonitorStatusService from "./MonitorStatusService";
 import ProjectService from "./ProjectService";
 import ServiceLevelObjectiveBurnRateRuleService from "./ServiceLevelObjectiveBurnRateRuleService";
 import ServiceLevelObjectiveMonitorRuleEngineService from "./ServiceLevelObjectiveMonitorRuleEngineService";
+import ServiceLevelObjectiveMonitorRuleService from "./ServiceLevelObjectiveMonitorRuleService";
 import ServiceLevelObjectiveOwnerTeamService from "./ServiceLevelObjectiveOwnerTeamService";
 import ServiceLevelObjectiveOwnerUserService from "./ServiceLevelObjectiveOwnerUserService";
 import TeamMemberService from "./TeamMemberService";
+import ServiceLevelObjectiveFeedService from "./ServiceLevelObjectiveFeedService";
+import { ServiceLevelObjectiveFeedEventType } from "../../Models/DatabaseModels/ServiceLevelObjectiveFeed";
+import { Blue500, Gray500, Green500, Orange500, Yellow500, } from "../../Types/BrandColors";
+import { SLO_FEED_IS_ARCHIVED_COLUMN, SLO_FEED_IS_ENABLED_COLUMN, SLO_FEED_MONITORS_COLUMN, SLO_FEED_UPDATE_COLUMNS, getSloArchivedFeedMarkdown, getSloCreatedFeedMarkdown, getSloEnabledFeedMarkdown, getSloFeedColumnChanges, getSloFeedEntityIds, getSloFeedSelect, getSloFeedWatchedColumns, getSloMonitorsChangedFeedMarkdown, getSloUpdatedFeedMarkdown, isSloFeedValueEqual, normalizeSloFeedBoolean, } from "../../Utils/Slo/SloFeedMarkdown";
+import SloFeedUtil from "../Utils/Slo/SloFeedUtil";
+import SloLegacyMonitorLabelAdoption from "../Utils/Slo/SloLegacyMonitorLabelAdoption";
+/*
+ * The root cause stamped on every burn-rate alert and incident an archive
+ * resolves. Distinct from the disable/delete default so a responder reading a
+ * closed page can tell "somebody retired this SLO" from "somebody paused it" -
+ * the first will not come back on its own, the second may.
+ */
+export const SLO_ARCHIVED_ROOT_CAUSE = "Auto-resolved because the Service Level Objective was archived.";
+export const SLO_DISABLED_OR_DELETED_ROOT_CAUSE = "Auto-resolved because the Service Level Objective was disabled or deleted.";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
@@ -93,8 +110,14 @@ export class Service extends DatabaseService {
             carryForward: null,
         };
     }
-    async onCreateSuccess(_onCreate, createdItem) {
+    async onCreateSuccess(onCreate, createdItem) {
         var _a, _b, _c, _d, _e, _f;
+        /*
+         * The row's own creation time, so the "created" feed item - written last,
+         * and without waiting - still sorts ahead of everything the create sets
+         * off, like the creator being added as an owner.
+         */
+        const createdAt = createdItem.createdAt || OneUptimeDate.getCurrentDate();
         /*
          * Stamp nextEvaluationAt = now so the evaluation worker picks this SLO up
          * on its next tick. Done here (isRoot update) instead of onBeforeCreate
@@ -117,16 +140,40 @@ export class Service extends DatabaseService {
             logger.error(`Error setting nextEvaluationAt for SLO ${(_a = createdItem.id) === null || _a === void 0 ? void 0 : _a.toString()}: ${err}`, { projectId: (_b = createdItem.projectId) === null || _b === void 0 ? void 0 : _b.toString() });
         }
         // Seed the two canonical multi-window burn rate rules. Non-fatal.
+        let seededBurnRateRules = [];
         try {
-            await this.seedDefaultBurnRateRules(createdItem);
+            /*
+             * Marked as seeding so the burn rate rule service does not post its own
+             * "rule added" items for these two: they are part of creating the SLO
+             * and are described by its "created" item (see SloFeedUtil for why this
+             * signal and not "root with no user").
+             */
+            seededBurnRateRules = createdItem.id
+                ? await SloFeedUtil.runWhileSeedingDefaultBurnRateRules({
+                    sloId: createdItem.id,
+                    seed: () => {
+                        return this.seedDefaultBurnRateRules(createdItem);
+                    },
+                })
+                : await this.seedDefaultBurnRateRules(createdItem);
         }
         catch (err) {
             logger.error(`Error seeding default burn rate rules for SLO ${(_c = createdItem.id) === null || _c === void 0 ? void 0 : _c.toString()}: ${err}`, { projectId: (_d = createdItem.projectId) === null || _d === void 0 ? void 0 : _d.toString() });
         }
         /*
-         * An SLO created with a label rule must already carry the monitors that
-         * rule matches — otherwise it reads "no monitors attached, cannot be
-         * evaluated" until someone happens to edit a monitor.
+         * A create that still carries the deprecated "Auto-Add Monitors With
+         * Labels" list gets it as a monitor rule first, so the sync below attaches
+         * what the list matches - as the previous release did. See
+         * applyDeprecatedMonitorLabelWrite for who still sends it and why.
+         */
+        await this.adoptDeprecatedMonitorLabelsWrittenOnCreate(createdItem);
+        /*
+         * Reconcile the new SLO's monitor list with its monitor rules. A brand-new
+         * SLO normally has none yet (rules are added afterwards, on the Monitor
+         * Rules page), so this is usually a read and no write - but it keeps an
+         * SLO created with rows already pointing at it (an API import, a rolling
+         * deploy's backfill) from reading "no monitors attached" until someone
+         * happens to edit a rule or a monitor.
          */
         try {
             await ServiceLevelObjectiveMonitorRuleEngineService.syncMonitorsForSlo({
@@ -134,8 +181,22 @@ export class Service extends DatabaseService {
             });
         }
         catch (err) {
-            logger.error(`Error applying the monitor label rule for SLO ${(_e = createdItem.id) === null || _e === void 0 ? void 0 : _e.toString()}: ${err}`, { projectId: (_f = createdItem.projectId) === null || _f === void 0 ? void 0 : _f.toString() });
+            logger.error(`Error applying the monitor rules for SLO ${(_e = createdItem.id) === null || _e === void 0 ? void 0 : _e.toString()}: ${err}`, { projectId: (_f = createdItem.projectId) === null || _f === void 0 ? void 0 : _f.toString() });
         }
+        /*
+         * Fire-and-forget, like ServiceService's created item: the SLO exists
+         * whether or not its feed item does, and the create request should not
+         * wait on user and link lookups just to describe itself.
+         */
+        this.writeSloCreatedFeed({
+            onCreate: onCreate,
+            createdItem: createdItem,
+            seededBurnRateRules: seededBurnRateRules,
+            postedAt: createdAt,
+        }).catch((err) => {
+            var _a, _b;
+            logger.error(`Error writing the created feed item for SLO ${(_a = createdItem.id) === null || _a === void 0 ? void 0 : _a.toString()}: ${err}`, { projectId: (_b = createdItem.projectId) === null || _b === void 0 ? void 0 : _b.toString() });
+        });
         return createdItem;
     }
     async onBeforeUpdate(updateBy) {
@@ -160,19 +221,54 @@ export class Service extends DatabaseService {
             updateBy.data.atRiskThresholdPercentage =
                 this.validateAtRiskThresholdPercentage(newAtRiskThresholdPercentage);
         }
+        await this.assertMonitorEditRespectsMonitorRules(updateBy);
+        /*
+         * Last, so a payload the checks above rejected never costs the feed a
+         * read. Null unless the payload writes a column the feed describes.
+         */
+        const feedSnapshot = await this.readFeedSnapshotBeforeUpdate(updateBy);
+        // Null unless the payload writes the deprecated monitor label list.
+        const monitorLabelIdsBeforeUpdate = await this.readDeprecatedMonitorLabelsBeforeUpdate(updateBy);
         return {
             updateBy,
-            carryForward: null,
+            carryForward: {
+                feedSnapshot: feedSnapshot,
+                monitorLabelIdsBeforeUpdate: monitorLabelIdsBeforeUpdate,
+            },
         };
     }
     async onUpdateSuccess(onUpdate, updatedItemIds) {
+        var _a, _b;
         /*
-         * When an SLO is disabled, resolve everything its burn-rate rules have
-         * open — the evaluation worker skips disabled SLOs, so nothing else
-         * would ever resolve them (and their on-call escalations would stay
-         * open forever).
+         * Fire-and-forget, and only when onBeforeUpdate took a snapshot - so the
+         * worker's per-tick state write does no feed work at all. The time is
+         * taken here so the items sort where the edit happened, not where their
+         * lookups finished.
+         */
+        if ((_a = onUpdate.carryForward) === null || _a === void 0 ? void 0 : _a.feedSnapshot) {
+            const updatedAt = OneUptimeDate.getCurrentDate();
+            this.writeSloUpdatedFeed({
+                onUpdate: onUpdate,
+                updatedItemIds: updatedItemIds,
+                postedAt: updatedAt,
+            }).catch((err) => {
+                logger.error(`Error writing SLO feed items after an update: ${err}`);
+            });
+        }
+        /*
+         * When an SLO is disabled or archived, resolve everything its burn-rate
+         * rules have open — the evaluation worker skips disabled and archived
+         * SLOs alike, so nothing else would ever resolve them (and their on-call
+         * escalations would stay open forever).
+         *
+         * One pass even when a single write both disables and archives: the
+         * second would only re-query every rule for records the first already
+         * closed. The archive wording wins, because it is the more permanent of
+         * the two and the one a responder reading the root cause needs to know.
          */
-        if (onUpdate.updateBy.data.isEnabled === false) {
+        const isDisablingSlo = onUpdate.updateBy.data.isEnabled === false;
+        const isArchivingSlo = onUpdate.updateBy.data.isArchived === true;
+        if (isDisablingSlo || isArchivingSlo) {
             for (const updatedItemId of updatedItemIds) {
                 try {
                     const slo = await this.findOneById({
@@ -187,42 +283,71 @@ export class Service extends DatabaseService {
                     if (!slo || !slo.projectId) {
                         continue;
                     }
-                    await this.resolveOpenBurnRateAlertsAndIncidentsForSlo({
+                    /*
+                     * rootCause is only set for an archive, so a plain disable keeps
+                     * calling with exactly the payload it always has.
+                     */
+                    const resolveData = {
                         sloId: updatedItemId,
                         projectId: slo.projectId,
-                    });
+                    };
+                    if (isArchivingSlo) {
+                        resolveData.rootCause = SLO_ARCHIVED_ROOT_CAUSE;
+                    }
+                    await this.resolveOpenBurnRateAlertsAndIncidentsForSlo(resolveData);
                 }
                 catch (err) {
-                    logger.error(`Error resolving open burn rate alerts and incidents for disabled SLO ${updatedItemId.toString()}: ${err}`);
+                    /*
+                     * Never fail the user's write: the disable or archive already
+                     * landed, and refusing it over a stale open record would be worse
+                     * than the record itself.
+                     */
+                    logger.error(`Error resolving open burn rate alerts and incidents for ${isArchivingSlo ? "archived" : "disabled"} SLO ${updatedItemId.toString()}: ${err}`);
                 }
             }
         }
         /*
-         * The label rule changed, so the monitor set it implies changed with it.
-         * Re-run it before the re-evaluation stamp below: the sync writes
-         * `monitors`, which goes through this same hook and stamps
-         * nextEvaluationAt itself once the new set is persisted.
+         * Monitor membership follows the SLO's monitor rules, and
+         * ServiceLevelObjectiveMonitorRuleService re-syncs whenever one of those
+         * changes, so an ordinary SLO edit needs no sync. The exception is a write
+         * of the deprecated "Auto-Add Monitors With Labels" list, which nothing
+         * else on this release would act on - see applyDeprecatedMonitorLabelWrite.
          */
-        if (onUpdate.updateBy.data.monitorLabels !== undefined) {
-            for (const updatedItemId of updatedItemIds) {
-                try {
-                    await ServiceLevelObjectiveMonitorRuleEngineService.syncMonitorsForSlo({
-                        serviceLevelObjectiveId: updatedItemId,
-                    });
-                }
-                catch (err) {
-                    logger.error(`Error applying the monitor label rule for SLO ${updatedItemId.toString()}: ${err}`);
-                }
-            }
+        if (onUpdate.updateBy.data.monitorLabels !== undefined &&
+            updatedItemIds.length > 0) {
+            await this.applyDeprecatedMonitorLabelWrite({
+                serviceLevelObjectiveIds: updatedItemIds,
+                writtenMonitorLabels: onUpdate.updateBy.data.monitorLabels,
+                labelIdsBeforeUpdateBySloId: ((_b = onUpdate.carryForward) === null || _b === void 0 ? void 0 : _b.monitorLabelIdsBeforeUpdate) || {},
+            });
         }
         /*
          * If the objective's math inputs changed, force a re-evaluation on the
          * worker's next tick.
+         *
+         * "Inputs" means every column the worker's result depends on, not only
+         * the objective's: the downtime statuses and multi-monitor mode decide
+         * which seconds count as bad, the timezone moves calendar-month
+         * boundaries, and the at-risk threshold decides the status. All four are
+         * edited on the Settings page, and without them a saved change kept
+         * showing the old numbers until the SLO's regular cadence came round.
          */
         const isEvaluationConfigUpdated = onUpdate.updateBy.data.targetPercentage !== undefined ||
             onUpdate.updateBy.data.windowDays !== undefined ||
             onUpdate.updateBy.data.windowType !== undefined ||
-            onUpdate.updateBy.data.monitors !== undefined;
+            onUpdate.updateBy.data.monitors !== undefined ||
+            onUpdate.updateBy.data.multiMonitorMode !== undefined ||
+            onUpdate.updateBy.data.downtimeMonitorStatuses !== undefined ||
+            onUpdate.updateBy.data.atRiskThresholdPercentage !== undefined ||
+            onUpdate.updateBy.data.timezone !== undefined ||
+            /*
+             * Unarchived: the worker stopped looking at this SLO while it was
+             * archived, so its status and budget are frozen at archive time. Its
+             * nextEvaluationAt is normally already in the past, but stamping it
+             * explicitly guarantees the numbers refresh on the very next tick.
+             * (A still-disabled SLO stays skipped by getDueSlos regardless.)
+             */
+            onUpdate.updateBy.data.isArchived === false;
         if (isEvaluationConfigUpdated) {
             for (const updatedItemId of updatedItemIds) {
                 try {
@@ -243,10 +368,36 @@ export class Service extends DatabaseService {
         }
         return onUpdate;
     }
+    /*
+     * READ ONLY: notes down the SLOs this delete may remove and, for each, the
+     * burn rate rules whose open alerts and incidents onDeleteSuccess resolves.
+     *
+     * The rules have to be read now. They cascade away with the SLO in Postgres,
+     * with no hook of their own, and a rule's id is half of the fingerprint that
+     * finds what it opened.
+     *
+     * Nothing is resolved here. DatabaseService runs this hook BEFORE it applies
+     * the caller's delete permissions, and the CRUD API passes a raw id, so these
+     * rows are only candidates. Resolving here as root let a delete that named
+     * another project's SLO close that project's burn rate alerts and incidents
+     * while deleting nothing. onDeleteSuccess acts only on the ids the delete
+     * really removed, and the tenant pin keeps this read from even seeing
+     * another project's SLOs. A multi-tenant request is left unpinned because
+     * DatabaseService does not pin it either: candidates narrower than what the
+     * delete removes would strand records instead.
+     *
+     * A failed read is deliberately not caught: deleting an SLO without knowing
+     * its rules would strand everything they opened, and the on-call escalations
+     * with it, because the evaluation worker never looks at a deleted SLO again.
+     */
     async onBeforeDelete(deleteBy) {
-        var _a, _b;
         const itemsToDelete = await this.findBy({
-            query: deleteBy.query,
+            query: SloFeedUtil.getTenantPinnedQuery({
+                query: deleteBy.query,
+                tenantId: deleteBy.props.isMultiTenantRequest
+                    ? undefined
+                    : deleteBy.props.tenantId,
+            }),
             limit: LIMIT_MAX,
             skip: 0,
             select: {
@@ -257,34 +408,109 @@ export class Service extends DatabaseService {
                 isRoot: true,
             },
         });
+        const burnRateRules = [];
         for (const item of itemsToDelete) {
             if (!item.id || !item.projectId) {
                 continue;
             }
-            try {
-                await this.resolveOpenBurnRateAlertsAndIncidentsForSlo({
-                    sloId: item.id,
+            const rulesOfSlo = await ServiceLevelObjectiveBurnRateRuleService.findBy({
+                query: {
+                    serviceLevelObjectiveId: item.id,
                     projectId: item.projectId,
-                });
-            }
-            catch (err) {
-                logger.error(`Error resolving open burn rate alerts and incidents for SLO ${(_a = item.id) === null || _a === void 0 ? void 0 : _a.toString()} before delete: ${err}`, { projectId: (_b = item.projectId) === null || _b === void 0 ? void 0 : _b.toString() });
-            }
+                },
+                select: {
+                    _id: true,
+                    projectId: true,
+                    serviceLevelObjectiveId: true,
+                },
+                skip: 0,
+                limit: LIMIT_PER_PROJECT,
+                props: {
+                    isRoot: true,
+                },
+            });
+            burnRateRules.push(...rulesOfSlo);
         }
+        const carryForward = {
+            itemsToDelete: itemsToDelete,
+            burnRateRules: burnRateRules,
+        };
         return {
             deleteBy,
-            carryForward: {
-                itemsToDelete: itemsToDelete,
-            },
+            carryForward: carryForward,
         };
     }
+    /*
+     * Resolves what the burn rate rules of every SLO this delete really removed
+     * left open. Nothing else ever will: the evaluation worker never looks at a
+     * deleted SLO again, so those alerts and incidents, and their on-call
+     * escalations, would otherwise stay open forever.
+     *
+     * Only the SLOs whose ids DatabaseService reports as deleted are acted on
+     * (SloFeedUtil.getRowsActuallyDeleted), never every candidate onBeforeDelete
+     * read - see there for why.
+     *
+     * Resolving after the delete is safe: open records are found by fingerprint
+     * in the Alert and Incident tables, not through the SLO or rule rows. It is
+     * also the honest order - a delete that fails leaves its records open next
+     * to the SLO that still stands behind them.
+     *
+     * Rule by rule rather than through resolveOpenBurnRateAlertsAndIncidentsForSlo:
+     * that one reads the SLO's rules, which the cascade has already removed, and
+     * clears their lifecycle columns, which no longer exist.
+     */
+    async onDeleteSuccess(onDelete, itemIdsBeforeDelete) {
+        const carryForward = onDelete.carryForward || null;
+        const deletedSlos = SloFeedUtil.getRowsActuallyDeleted({
+            rows: (carryForward === null || carryForward === void 0 ? void 0 : carryForward.itemsToDelete) || [],
+            deletedIds: itemIdsBeforeDelete,
+        });
+        for (const slo of deletedSlos) {
+            if (!slo.id || !slo.projectId) {
+                continue;
+            }
+            const sloId = slo.id;
+            const projectId = slo.projectId;
+            const rulesOfSlo = ((carryForward === null || carryForward === void 0 ? void 0 : carryForward.burnRateRules) || []).filter((rule) => {
+                var _a;
+                return (((_a = rule.serviceLevelObjectiveId) === null || _a === void 0 ? void 0 : _a.toString().toLowerCase()) ===
+                    sloId.toString().toLowerCase());
+            });
+            for (const rule of rulesOfSlo) {
+                if (!rule.id) {
+                    continue;
+                }
+                try {
+                    await ServiceLevelObjectiveBurnRateRuleService.resolveOpenAlertsAndIncidentsForRule({
+                        serviceLevelObjectiveId: sloId,
+                        burnRateRuleId: rule.id,
+                        projectId: projectId,
+                        rootCause: SLO_DISABLED_OR_DELETED_ROOT_CAUSE,
+                    });
+                }
+                catch (err) {
+                    /*
+                     * Never fail the request - the SLO is already gone - and never let
+                     * one rule's failure cost the next rule its resolve.
+                     */
+                    logger.error(`Error resolving open alerts and incidents for burn rate rule ${rule.id.toString()} of deleted SLO ${sloId.toString()}: ${err}`, { projectId: projectId.toString() });
+                }
+            }
+        }
+        return onDelete;
+    }
     /*
      * Resolve everything any of this SLO's burn rate rules has left open — the
      * Alerts they raised and the Incidents they declared. Called when the SLO is
-     * disabled or deleted, and by the worker's Misconfigured / Paused guards.
+     * disabled, archived or deleted, and by the worker's Misconfigured / Paused
+     * guards.
+     *
+     * `rootCause` is what the resolved records say closed them; it defaults to
+     * the disable/delete wording so every existing caller is unchanged.
      */
     async resolveOpenBurnRateAlertsAndIncidentsForSlo(data) {
         var _a, _b, _c;
+        const rootCause = data.rootCause || SLO_DISABLED_OR_DELETED_ROOT_CAUSE;
         const burnRateRules = await ServiceLevelObjectiveBurnRateRuleService.findBy({
             query: {
                 serviceLevelObjectiveId: data.sloId,
@@ -322,7 +548,7 @@ export class Service extends DatabaseService {
                     serviceLevelObjectiveId: data.sloId,
                     burnRateRuleId: rule.id,
                     projectId: data.projectId,
-                    rootCause: "Auto-resolved because the Service Level Objective was disabled or deleted.",
+                    rootCause: rootCause,
                 });
                 /*
                  * The rule's own lifecycle columns still say it has something open —
@@ -351,14 +577,21 @@ export class Service extends DatabaseService {
         }
     }
     /*
-     * All enabled SLOs in active projects that are due for evaluation
-     * (nextEvaluationAt in the past, or never evaluated). Selects every config
-     * and state column the evaluation worker needs.
+     * All enabled, unarchived SLOs in active projects that are due for
+     * evaluation (nextEvaluationAt in the past, or never evaluated). Selects
+     * every config and state column the evaluation worker needs.
+     *
+     * Archived is checked separately from enabled on purpose: the two flags are
+     * independent (unarchiving must not re-enable an SLO somebody paused), and
+     * either one alone takes the SLO out of evaluation. The worker re-reads both
+     * right before a burn rate rule fires, because this snapshot can go stale
+     * while a long sweep is still running.
      */
     async getDueSlos() {
         return await this.findAllBy({
             query: {
                 isEnabled: true,
+                isArchived: false,
                 nextEvaluationAt: QueryHelper.lessThanEqualToOrNull(OneUptimeDate.getCurrentDate()),
                 project: Object.assign({}, ProjectService.getActiveProjectStatusQuery()),
             },
@@ -366,6 +599,15 @@ export class Service extends DatabaseService {
                 _id: true,
                 projectId: true,
                 name: true,
+                /*
+                 * Stamped as oneuptime.label.* on the oneuptime.slo.* metrics the
+                 * worker posts (SloMetricUtil), so SLO series group and filter by
+                 * the same labels as the SLO list.
+                 */
+                labels: {
+                    _id: true,
+                    name: true,
+                },
                 isEnabled: true,
                 sliType: true,
                 multiMonitorMode: true,
@@ -461,6 +703,46 @@ export class Service extends DatabaseService {
         const dashboardUrl = await DatabaseConfig.getDashboardUrl();
         return URL.fromString(dashboardUrl.toString()).addRoute(`/${projectId.toString()}/slos/${serviceLevelObjectiveId.toString()}`);
     }
+    /*
+     * `[SLO <name>](<dashboard link>)` for feed items and notifications.
+     *
+     * The name is user-controlled and feeds render without safe mode, so it is
+     * escaped here, once, at the point it becomes markdown - a name like
+     * `x](https://evil)` must not be able to re-point the link.
+     *
+     * Pass `sloName` whenever the caller already has it (the worker always
+     * does); the lookup is only a fallback for callers holding just an id. An
+     * SLO that cannot be found still gets a working link, labelled "SLO".
+     *
+     * The lookup is pinned to `projectId`. Its callers are feed writers running
+     * after a write, and several of them hold an SLO id nobody checked against
+     * the tenant (an owner row or burn rate rule created with another project's
+     * SLO id). Read as root without the pin, that id would copy another
+     * project's SLO name into a feed item the caller's project can read. An SLO
+     * outside the project is treated exactly like one that does not exist.
+     */
+    async getSloMarkdownLink(data) {
+        let sloName = data.sloName;
+        if (sloName === undefined) {
+            const slo = await this.findOneBy({
+                query: {
+                    _id: data.sloId.toString(),
+                    projectId: data.projectId,
+                },
+                select: {
+                    name: true,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+            sloName = (slo === null || slo === void 0 ? void 0 : slo.name) || undefined;
+        }
+        const link = await this.getSloLinkInDashboard(data.projectId, data.sloId);
+        const escapedName = escapeMarkdownInline(sloName).trim();
+        const linkText = escapedName ? `SLO ${escapedName}` : "SLO";
+        return `[${linkText}](${link.toString()})`;
+    }
     /*
      * Seed the two canonical Google-SRE multi-window burn rate rules, with
      * thresholds scaled to the SLO's compliance window. The textbook constants
@@ -471,8 +753,10 @@ export class Service extends DatabaseService {
      */
     async seedDefaultBurnRateRules(createdItem) {
         var _a, _b;
+        // The rules actually written, for the SLO's "created" feed item.
+        const seededRules = [];
         if (!createdItem.id || !createdItem.projectId) {
-            return;
+            return seededRules;
         }
         const windowHours = createdItem.windowType === SloWindowType.CalendarMonth
             ? 720
@@ -538,11 +822,662 @@ export class Service extends DatabaseService {
                         isRoot: true,
                     },
                 });
+                seededRules.push(rule);
             }
             catch (err) {
                 logger.error(`Error seeding default burn rate rule "${defaultRule.name}" for SLO ${(_a = createdItem.id) === null || _a === void 0 ? void 0 : _a.toString()}: ${err}`, { projectId: (_b = createdItem.projectId) === null || _b === void 0 ? void 0 : _b.toString() });
             }
         }
+        return seededRules;
+    }
+    /*
+     * The SLO's "created" feed item: who created it, what it promises, and the
+     * default burn rate rules that came with it (folded in here rather than
+     * posted as two more items underneath).
+     */
+    async writeSloCreatedFeed(data) {
+        const sloId = data.createdItem.id || undefined;
+        const projectId = data.createdItem.projectId;
+        if (!sloId || !projectId) {
+            return;
+        }
+        /*
+         * A dashboard, API-key or Terraform create carries an acting user; a
+         * workflow or other automation creating as root does not, and the item
+         * then says so instead of naming somebody.
+         */
+        const createdByUserId = data.createdItem.createdByUserId ||
+            data.onCreate.createBy.props.userId ||
+            undefined;
+        const createdByUserMarkdown = await SloFeedUtil.getUserMarkdown({
+            userId: createdByUserId,
+            projectId: projectId,
+        });
+        const markdown = getSloCreatedFeedMarkdown({
+            sloMarkdownLink: await this.getSloMarkdownLink({
+                projectId: projectId,
+                sloId: sloId,
+                sloName: data.createdItem.name || "",
+            }),
+            createdByUserMarkdown: createdByUserMarkdown,
+            targetPercentage: data.createdItem.targetPercentage,
+            windowType: data.createdItem.windowType,
+            windowDays: data.createdItem.windowDays,
+            timezone: data.createdItem.timezone,
+            sliType: data.createdItem.sliType,
+            atRiskThresholdPercentage: data.createdItem.atRiskThresholdPercentage,
+            description: data.createdItem.description,
+            defaultBurnRateRules: data.seededBurnRateRules,
+        });
+        await ServiceLevelObjectiveFeedService.createServiceLevelObjectiveFeedItem({
+            serviceLevelObjectiveId: sloId,
+            projectId: projectId,
+            serviceLevelObjectiveFeedEventType: ServiceLevelObjectiveFeedEventType.ServiceLevelObjectiveCreated,
+            displayColor: Green500,
+            feedInfoInMarkdown: markdown.feedInfoInMarkdown,
+            moreInformationInMarkdown: markdown.moreInformationInMarkdown,
+            // Only a user who still exists gets the avatar; otherwise "no user".
+            userId: createdByUserMarkdown ? createdByUserId : undefined,
+            postedAt: data.postedAt,
+        });
+    }
+    /*
+     * The before-half of the feed's change detection: the watched columns this
+     * payload writes, and every matched SLO as it is before the write.
+     *
+     * Two rules keep this off the hot paths:
+     *
+     *   - It reads ONLY when the payload writes a watched column, and that is
+     *     checked before any query. The evaluation worker writes this row on
+     *     every tick (SLI, budget, burn rate, status) and the cadence stamps go
+     *     through here too; none of those columns is watched, so they cost
+     *     nothing.
+     *
+     *   - A root write of `monitors` is the monitor rule engine keeping
+     *     rule-owned monitors in sync. The engine posts its own attach/detach
+     *     items, so `monitors` is only watched on a non-root (hand-made) edit -
+     *     which also spares every engine sync a read.
+     *
+     * A failed read never blocks the update; the feed just does not describe it.
+     */
+    async readFeedSnapshotBeforeUpdate(updateBy) {
+        const columns = getSloFeedWatchedColumns({
+            payload: updateBy.data,
+            includeMonitors: !updateBy.props.isRoot,
+        });
+        if (columns.length === 0) {
+            return null;
+        }
+        try {
+            const rows = await this.findBy({
+                // Pinned: this hook runs before DatabaseService applies permissions.
+                query: SloFeedUtil.getTenantPinnedQuery({
+                    query: updateBy.query,
+                    tenantId: updateBy.props.tenantId,
+                }),
+                select: this.getFeedSelect(columns),
+                limit: updateBy.limit,
+                skip: updateBy.skip,
+                props: {
+                    isRoot: true,
+                },
+            });
+            const rowsById = {};
+            for (const row of rows) {
+                if (row.id) {
+                    rowsById[row.id.toString()] = row;
+                }
+            }
+            return {
+                columns: columns,
+                rowsById: rowsById,
+            };
+        }
+        catch (err) {
+            logger.error(`Error reading SLOs before an update for the SLO feed: ${err}`);
+            return null;
+        }
+    }
+    getFeedSelect(columns) {
+        return Object.assign({ _id: true, projectId: true, name: true, 
+            // Both flags word the enable / archive items, whichever one changed.
+            isEnabled: true, isArchived: true }, getSloFeedSelect(columns));
+    }
+    async writeSloUpdatedFeed(data) {
+        var _a, _b;
+        const snapshot = ((_a = data.onUpdate.carryForward) === null || _a === void 0 ? void 0 : _a.feedSnapshot) || null;
+        if (!snapshot ||
+            snapshot.columns.length === 0 ||
+            data.updatedItemIds.length === 0) {
+            return;
+        }
+        for (const sloId of data.updatedItemIds) {
+            const before = snapshot.rowsById[sloId.toString()];
+            // Not in the snapshot means there is nothing to compare against.
+            if (!before) {
+                continue;
+            }
+            try {
+                await this.writeFeedItemsForUpdatedSlo({
+                    sloId: sloId,
+                    before: before,
+                    columns: snapshot.columns,
+                    payload: data.onUpdate.updateBy.data,
+                    userId: data.onUpdate.updateBy.props.userId || undefined,
+                    postedAt: data.postedAt,
+                });
+            }
+            catch (err) {
+                logger.error(`Error writing feed items for updated SLO ${sloId.toString()}: ${err}`, { projectId: (_b = before.projectId) === null || _b === void 0 ? void 0 : _b.toString() });
+            }
+        }
+    }
+    /*
+     * Compares one SLO before and after the write and posts what really
+     * changed: archive / restore, enable / disable, an "updated" item with old
+     * and new values, and hand-made monitor attaches and detaches. A form that
+     * re-submits every field it shows posts nothing for the fields it did not
+     * change.
+     */
+    async writeFeedItemsForUpdatedSlo(data) {
+        const projectId = data.before.projectId;
+        if (!projectId) {
+            return;
+        }
+        const after = await this.findOneById({
+            id: data.sloId,
+            select: this.getFeedSelect(data.columns),
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!after) {
+            return;
+        }
+        const isWatched = (column) => {
+            return data.columns.some((watched) => {
+                return watched.column === column.column;
+            });
+        };
+        const beforeRow = data.before;
+        const afterRow = after;
+        // Unset reads as the column defaults: enabled, not archived.
+        const isEnabled = normalizeSloFeedBoolean(after.isEnabled) !== false;
+        const isArchived = normalizeSloFeedBoolean(after.isArchived) === true;
+        const pendingItems = [];
+        if (isWatched(SLO_FEED_IS_ARCHIVED_COLUMN) &&
+            !isSloFeedValueEqual(SLO_FEED_IS_ARCHIVED_COLUMN, beforeRow, afterRow)) {
+            pendingItems.push({
+                eventType: isArchived
+                    ? ServiceLevelObjectiveFeedEventType.ServiceLevelObjectiveArchived
+                    : ServiceLevelObjectiveFeedEventType.ServiceLevelObjectiveRestored,
+                displayColor: isArchived ? Yellow500 : Blue500,
+                getMarkdown: (sloMarkdownLink) => {
+                    return getSloArchivedFeedMarkdown({
+                        sloMarkdownLink: sloMarkdownLink,
+                        isArchived: isArchived,
+                        isEnabled: isEnabled,
+                    });
+                },
+            });
+        }
+        if (isWatched(SLO_FEED_IS_ENABLED_COLUMN) &&
+            !isSloFeedValueEqual(SLO_FEED_IS_ENABLED_COLUMN, beforeRow, afterRow)) {
+            pendingItems.push({
+                eventType: isEnabled
+                    ? ServiceLevelObjectiveFeedEventType.ServiceLevelObjectiveEnabled
+                    : ServiceLevelObjectiveFeedEventType.ServiceLevelObjectiveDisabled,
+                displayColor: isEnabled ? Green500 : Gray500,
+                getMarkdown: (sloMarkdownLink) => {
+                    return getSloEnabledFeedMarkdown({
+                        sloMarkdownLink: sloMarkdownLink,
+                        isEnabled: isEnabled,
+                        isArchived: isArchived,
+                    });
+                },
+            });
+        }
+        const changes = getSloFeedColumnChanges({
+            columns: data.columns.filter((column) => {
+                return SLO_FEED_UPDATE_COLUMNS.some((updateColumn) => {
+                    return updateColumn.column === column.column;
+                });
+            }),
+            before: beforeRow,
+            after: afterRow,
+        });
+        if (changes.length > 0) {
+            pendingItems.push({
+                eventType: ServiceLevelObjectiveFeedEventType.ServiceLevelObjectiveUpdated,
+                displayColor: Gray500,
+                getMarkdown: (sloMarkdownLink) => {
+                    return getSloUpdatedFeedMarkdown({
+                        sloMarkdownLink: sloMarkdownLink,
+                        changes: changes,
+                    });
+                },
+            });
+        }
+        if (isWatched(SLO_FEED_MONITORS_COLUMN)) {
+            pendingItems.push(...(await this.getManualMonitorFeedItems({
+                projectId: projectId,
+                before: data.before,
+                after: after,
+                writtenMonitors: data.payload["monitors"],
+            })));
+        }
+        if (pendingItems.length === 0) {
+            return;
+        }
+        const sloMarkdownLink = await this.getSloMarkdownLink({
+            projectId: projectId,
+            sloId: data.sloId,
+            sloName: after.name || data.before.name || "",
+        });
+        for (const pendingItem of pendingItems) {
+            const markdown = pendingItem.getMarkdown(sloMarkdownLink);
+            await ServiceLevelObjectiveFeedService.createServiceLevelObjectiveFeedItem({
+                serviceLevelObjectiveId: data.sloId,
+                projectId: projectId,
+                serviceLevelObjectiveFeedEventType: pendingItem.eventType,
+                displayColor: pendingItem.displayColor,
+                feedInfoInMarkdown: markdown.feedInfoInMarkdown,
+                moreInformationInMarkdown: markdown.moreInformationInMarkdown,
+                userId: data.userId,
+                postedAt: data.postedAt,
+            });
+        }
+    }
+    /*
+     * MonitorsAttached / MonitorsDetached for a hand-made edit of the monitor
+     * set (the rule engine's root writes never get here - see
+     * readFeedSnapshotBeforeUpdate).
+     *
+     * The new set is taken from the PAYLOAD, not from the re-read row: this
+     * writer runs after the request, and by then a rule sync may already have
+     * written the SLO's monitors again. Diffing against that would re-describe
+     * the engine's own changes, which the engine posts itself. The re-read is
+     * used only to put names on the monitors that were attached.
+     */
+    async getManualMonitorFeedItems(data) {
+        const beforeIds = new Set(getSloFeedEntityIds(data.before.monitors));
+        const writtenIds = new Set(getSloFeedEntityIds(data.writtenMonitors));
+        const attachedIds = Array.from(writtenIds).filter((id) => {
+            return !beforeIds.has(id);
+        });
+        const detachedIds = Array.from(beforeIds).filter((id) => {
+            return !writtenIds.has(id);
+        });
+        if (attachedIds.length === 0 && detachedIds.length === 0) {
+            return [];
+        }
+        const nameById = {};
+        for (const monitor of [
+            ...(data.before.monitors || []),
+            ...(data.after.monitors || []),
+        ]) {
+            const id = getSloFeedEntityIds([monitor])[0];
+            if (id && monitor.name) {
+                nameById[id] = monitor.name;
+            }
+        }
+        const dashboardUrl = await DatabaseConfig.getDashboardUrl();
+        const toReferences = (ids) => {
+            return ids.map((id) => {
+                return {
+                    name: nameById[id] || "",
+                    link: SloFeedUtil.getMonitorLinkInDashboard({
+                        dashboardUrl: dashboardUrl,
+                        projectId: data.projectId,
+                        monitorId: id,
+                    }),
+                };
+            });
+        };
+        const items = [];
+        if (attachedIds.length > 0) {
+            const attached = toReferences(attachedIds);
+            items.push({
+                eventType: ServiceLevelObjectiveFeedEventType.MonitorsAttached,
+                displayColor: Blue500,
+                getMarkdown: (sloMarkdownLink) => {
+                    return getSloMonitorsChangedFeedMarkdown({
+                        sloMarkdownLink: sloMarkdownLink,
+                        monitors: attached,
+                        change: "attached",
+                    });
+                },
+            });
+        }
+        if (detachedIds.length > 0) {
+            const detached = toReferences(detachedIds);
+            items.push({
+                eventType: ServiceLevelObjectiveFeedEventType.MonitorsDetached,
+                displayColor: Orange500,
+                getMarkdown: (sloMarkdownLink) => {
+                    return getSloMonitorsChangedFeedMarkdown({
+                        sloMarkdownLink: sloMarkdownLink,
+                        monitors: detached,
+                        change: "detached",
+                    });
+                },
+            });
+        }
+        return items;
+    }
+    /*
+     * What a write of the deprecated "Auto-Add Monitors With Labels" list
+     * (ServiceLevelObjective.monitorLabels) does on this release.
+     *
+     * The column stays in the API so upgrades do not break, and it is still
+     * written: a dashboard tab opened before the upgrade sends it with every
+     * save of the SLO form, and so can an API client or a workflow written
+     * against the previous release. Workflows write as root, which is why every
+     * caller is handled here, not only users - nothing on this release writes
+     * the column for its own reasons. Nothing else on this release reads it
+     * either, so storing it and moving on left the SLO measuring something other
+     * than what the caller had just saved. It is applied instead, the way this
+     * release applies labels - as a monitor rule:
+     *
+     *   - An SLO with no monitor rule row gets the list as a rule
+     *     (SloLegacyMonitorLabelAdoption) and is re-synced straight away, so its
+     *     monitors reflect the list at once. A list cleared to empty has nothing
+     *     to adopt, and the sync releases the monitors it attached - both what
+     *     the previous release did.
+     *   - An SLO that already has monitor rules, enabled or disabled, IGNORES
+     *     the list, with a warning in the log when the list changed. Its rules
+     *     are what it measures and what its Monitor Rules page shows. Folding the
+     *     list into one of them was rejected: the form that sends it cannot show
+     *     rules and re-submits the list it loaded, so it would undo edits made on
+     *     the Monitor Rules page, and once the converted rule has been renamed,
+     *     edited or deleted there is no rule the list reliably "is".
+     *
+     * Only a CHANGED list is adopted without evidence. The same list re-submitted
+     * by an out-of-date form is adopted only while monitors are still attached
+     * by it (the previous release's engine attached them), so re-saving that
+     * form cannot bring back a converted rule the user deleted. See
+     * readDeprecatedMonitorLabelsBeforeUpdate.
+     *
+     * Never throws: the write has landed, and a failure here must not fail the
+     * request. An SLO whose adoption failed is not synced this time, because a
+     * sync without its rule would release the monitors the list attached.
+     */
+    async applyDeprecatedMonitorLabelWrite(data) {
+        try {
+            // Sorted, de-duplicated and lower-case, so two lists compare joined.
+            const writtenLabelIds = getSloFeedEntityIds(data.writtenMonitorLabels);
+            // Root, by id: these are the rows the permission-checked write changed.
+            const slos = await this.findBy({
+                query: {
+                    _id: QueryHelper.any(data.serviceLevelObjectiveIds),
+                },
+                select: {
+                    _id: true,
+                    projectId: true,
+                },
+                limit: data.serviceLevelObjectiveIds.length,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+            const sloIdsWithRules = await ServiceLevelObjectiveMonitorRuleService.findServiceLevelObjectiveIdsWithAnyRule(slos
+                .map((slo) => {
+                return slo.id;
+            })
+                .filter((id) => {
+                return Boolean(id);
+            }));
+            const adoptionGroups = new Map();
+            const sloIdsToSync = [];
+            for (const slo of slos) {
+                if (!slo.id || !slo.projectId) {
+                    continue;
+                }
+                const sloId = slo.id.toString().toLowerCase();
+                const labelIdsBeforeUpdate = data.labelIdsBeforeUpdateBySloId[sloId];
+                // Unknown (the read before the write failed) counts as re-submitted.
+                const isListChanged = labelIdsBeforeUpdate !== undefined &&
+                    labelIdsBeforeUpdate.join(",") !== writtenLabelIds.join(",");
+                if (sloIdsWithRules.has(sloId)) {
+                    if (isListChanged) {
+                        logger.warn(`Ignored a change to the deprecated "Auto-Add Monitors With Labels" list of SLO ${sloId}: the SLO has monitor rules, and they decide which monitors it measures. Change its monitor rules instead.`, {
+                            projectId: slo.projectId.toString(),
+                            serviceLevelObjectiveId: sloId,
+                        });
+                    }
+                    continue;
+                }
+                sloIdsToSync.push(sloId);
+                // An empty list has nothing to adopt; the sync alone releases it.
+                if (writtenLabelIds.length === 0) {
+                    continue;
+                }
+                const groupKey = `${slo.projectId.toString()}|${isListChanged}`;
+                const group = adoptionGroups.get(groupKey) || {
+                    projectId: slo.projectId,
+                    requireRuleAttachedMonitors: !isListChanged,
+                    serviceLevelObjectiveIds: [],
+                };
+                group.serviceLevelObjectiveIds.push(sloId);
+                adoptionGroups.set(groupKey, group);
+            }
+            const sloIdsNotToSync = new Set();
+            for (const group of adoptionGroups.values()) {
+                try {
+                    await SloLegacyMonitorLabelAdoption.adoptLegacyMonitorLabels({
+                        projectId: group.projectId,
+                        serviceLevelObjectiveIds: group.serviceLevelObjectiveIds,
+                        requireRuleAttachedMonitors: group.requireRuleAttachedMonitors,
+                    });
+                }
+                catch (err) {
+                    logger.error(`Error converting the deprecated monitor label list of SLOs ${group.serviceLevelObjectiveIds.join(", ")} into monitor rules; not re-syncing their monitors this time: ${err}`, { projectId: group.projectId.toString() });
+                    for (const sloId of group.serviceLevelObjectiveIds) {
+                        sloIdsNotToSync.add(sloId);
+                    }
+                }
+            }
+            for (const sloId of sloIdsToSync) {
+                if (sloIdsNotToSync.has(sloId)) {
+                    continue;
+                }
+                try {
+                    await ServiceLevelObjectiveMonitorRuleEngineService.syncMonitorsForSlo({
+                        serviceLevelObjectiveId: new ObjectID(sloId),
+                    });
+                }
+                catch (err) {
+                    // One SLO failing must not cost the others their sync.
+                    logger.error(`Error applying the monitor rules of SLO ${sloId} after its deprecated monitor label list was written: ${err}`);
+                }
+            }
+        }
+        catch (err) {
+            logger.error(`Error applying a write of the deprecated SLO monitor label list: ${err}`);
+        }
+    }
+    /*
+     * The create half of applyDeprecatedMonitorLabelWrite: a create carrying a
+     * non-empty deprecated label list gets it as a monitor rule before
+     * onCreateSuccess syncs the SLO's monitors. No evidence is asked for - a
+     * brand-new SLO has attached nothing and has no deleted rule to bring back -
+     * and it cannot have rules yet, so there is nothing to ignore it for.
+     *
+     * Never throws. A failed adoption is logged and leaves the SLO without the
+     * rule; the sync after it releases nothing, because nothing is attached yet.
+     */
+    async adoptDeprecatedMonitorLabelsWrittenOnCreate(createdItem) {
+        if (!createdItem.id ||
+            !createdItem.projectId ||
+            getSloFeedEntityIds(createdItem.monitorLabels).length === 0) {
+            return;
+        }
+        try {
+            await SloLegacyMonitorLabelAdoption.adoptLegacyMonitorLabels({
+                projectId: createdItem.projectId,
+                serviceLevelObjectiveIds: [createdItem.id],
+                requireRuleAttachedMonitors: false,
+            });
+        }
+        catch (err) {
+            logger.error(`Error converting the deprecated monitor label list of new SLO ${createdItem.id.toString()} into a monitor rule: ${err}`, { projectId: createdItem.projectId.toString() });
+        }
+    }
+    /*
+     * The deprecated label list of every SLO this update may write, as it is
+     * BEFORE the write, keyed by lower-case SLO id - or null when the payload
+     * does not write that list, which is every update this release's own
+     * clients make, so they pay nothing.
+     *
+     * applyDeprecatedMonitorLabelWrite compares it with the written list,
+     * because only a CHANGED list is somebody asking for something: an
+     * out-of-date SLO form re-sends every field it loaded, labels included, on
+     * every save.
+     *
+     * Pinned to the caller's tenant like the feed snapshot, since this runs
+     * before DatabaseService applies the update's permissions. A failed read
+     * never blocks the update; its SLOs then count as re-submitting their list,
+     * the reading that can never bring a deleted rule back.
+     */
+    async readDeprecatedMonitorLabelsBeforeUpdate(updateBy) {
+        if (updateBy.data.monitorLabels === undefined) {
+            return null;
+        }
+        const labelIdsBySloId = {};
+        try {
+            const rows = await this.findBy({
+                query: SloFeedUtil.getTenantPinnedQuery({
+                    query: updateBy.query,
+                    tenantId: updateBy.props.tenantId,
+                }),
+                select: {
+                    _id: true,
+                    monitorLabels: {
+                        _id: true,
+                    },
+                },
+                limit: updateBy.limit,
+                skip: updateBy.skip,
+                props: {
+                    isRoot: true,
+                },
+            });
+            for (const row of rows) {
+                if (row.id) {
+                    labelIdsBySloId[row.id.toString().toLowerCase()] =
+                        getSloFeedEntityIds(row.monitorLabels);
+                }
+            }
+        }
+        catch (err) {
+            logger.error(`Error reading SLO monitor label lists before an update: ${err}`);
+        }
+        return labelIdsBySloId;
+    }
+    /*
+     * The manual-add guard. While an SLO has at least one ENABLED monitor rule,
+     * its monitor list belongs to those rules, so a hand-edit may only take away
+     * monitors a person attached:
+     *
+     *   - adding a monitor that is not already attached is refused - the rules
+     *     decide what is measured, and the Monitors page says so;
+     *   - removing a monitor a rule attached is refused too - it would not
+     *     stick: it stays recorded in autoAddedMonitors and the next sync would
+     *     attach it again, which reads as the edit silently failing;
+     *   - removing a monitor attached by hand (before the rules were enabled)
+     *     stays allowed.
+     *
+     * Root writes pass untouched: the rule engine itself writes `monitors` as
+     * root, and it must never be refused by the guard that protects its output.
+     *
+     * This hook runs before DatabaseService's update permission check, so the
+     * caller's raw query is pinned to the caller's tenant before anything is
+     * read - a validation read must not answer questions about another
+     * project's SLOs.
+     */
+    async assertMonitorEditRespectsMonitorRules(updateBy) {
+        const nextMonitors = updateBy.data.monitors;
+        if (nextMonitors === undefined || updateBy.props.isRoot) {
+            return;
+        }
+        const query = Object.assign({}, updateBy.query);
+        if (updateBy.props.tenantId) {
+            query["projectId"] = updateBy.props.tenantId;
+        }
+        const slos = await this.findBy({
+            query: query,
+            select: {
+                _id: true,
+                monitors: {
+                    _id: true,
+                },
+                autoAddedMonitors: {
+                    _id: true,
+                },
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const sloIds = slos
+            .map((slo) => {
+            return slo.id;
+        })
+            .filter((id) => {
+            return Boolean(id);
+        });
+        if (sloIds.length === 0) {
+            return;
+        }
+        const sloIdsWithEnabledRules = await ServiceLevelObjectiveMonitorRuleService.findServiceLevelObjectiveIdsWithEnabledRules(sloIds);
+        if (sloIdsWithEnabledRules.size === 0) {
+            return;
+        }
+        const nextMonitorIds = this.toMonitorIdSet(nextMonitors);
+        for (const slo of slos) {
+            if (!slo.id ||
+                !sloIdsWithEnabledRules.has(slo.id.toString().toLowerCase())) {
+                continue;
+            }
+            const attachedMonitorIds = this.toMonitorIdSet(slo.monitors);
+            const isAddingMonitors = Array.from(nextMonitorIds).some((monitorId) => {
+                return !attachedMonitorIds.has(monitorId);
+            });
+            if (isAddingMonitors) {
+                throw new BadDataException("This SLO's monitors are managed by its monitor rules. Disable the rules to add monitors by hand.");
+            }
+            const isRemovingRuleAttachedMonitors = Array.from(this.toMonitorIdSet(slo.autoAddedMonitors)).some((monitorId) => {
+                return (attachedMonitorIds.has(monitorId) && !nextMonitorIds.has(monitorId));
+            });
+            if (isRemovingRuleAttachedMonitors) {
+                throw new BadDataException("A monitor rule attached this monitor, so removing it by hand would not stick: the rule would attach it again. Change or disable the rule to detach it.");
+            }
+        }
+    }
+    /*
+     * Monitor ids from any shape they reach this service in: Monitor rows from
+     * a read, `{ _id }` stubs or bare uuid strings from an API payload (which
+     * DatabaseService only turns into entities after onBeforeUpdate). Lower-case,
+     * because Postgres renders a uuid lower-case whatever case it was written in.
+     */
+    toMonitorIdSet(value) {
+        var _a;
+        const items = Array.isArray(value)
+            ? value
+            : value === null || value === undefined
+                ? []
+                : [value];
+        const ids = new Set();
+        for (const item of items) {
+            const id = ((_a = resolveReferenceId(item)) === null || _a === void 0 ? void 0 : _a.toString().trim().toLowerCase()) || "";
+            if (id) {
+                ids.add(id);
+            }
+        }
+        return ids;
     }
     roundToTwoDecimals(value) {
         return Math.round(value * 100) / 100;
@@ -627,6 +1562,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
@@ -652,5 +1593,11 @@ __decorate([
         ObjectID]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "getSloLinkInDashboard", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getSloMarkdownLink", null);
 export default new Service();
 //# sourceMappingURL=ServiceLevelObjectiveService.js.map